UNOFFICIAL
Hi Jakub,
I'm trying to use ID mapping, not POSIX - as the extensions aren't installed on
the domain controllers (and the extensions are now deprecated after 2012 R2!).
Most of the entries in the SSSD config (like selinux and subdomains_provider) were enabled
to reduce errors/warnings in the logs (and try to narrow down the cause of the issue). I
have now removed these.
The sssd.conf file now looks like the below.
I've also noticed that with the subdomains_provider config removed, it's
attempting to contact the parent domain and looks to be getting blocked by the firewalls
in between.
/etc/sssd/sssd.conf
[sssd]
config_file_version = 2
debug_level = 3
domains =
domain.subdomain.com
services = nss, pam, ssh, pac, sudo
default_domain_suffix =
domain.subdomain.com
[
domain/domain.subdomain.com]
debug_level = 9
id_provider = ad
access_provider = ad
auth_provider = ad
chpass_provider = ad
# Permits offline logins:
cache_credentials = true
default_shell = /bin/bash
fallback_homedir = /home/%d/%u
ldap_schema = ad
#Use FQDN for logins - when multiple domains share same username
use_fully_qualified_domain_names = true
#Don't attempt to auto update DNS records dyndns_update = false
[ssh]
debug_level = 3
[nss]
debug_level = 9
[pam]
debug_level = 3
[sudo]
debug_level = 3
[pac]
debug_level = 3